security1 distinct publisher
Five CVEs in a Markdown extension with 9.5 million installs, and none of it in your SBOM
ProjectDiscovery says an audit of Markdown Preview Enhanced turned an ordinary repository file into arbitrary file write. Editor extensions run with developer privileges and go uninventoried.
Publishers:projectdiscovery.io
Reality
- Evidence64
- Adoption68
- Hype gap+14
- Incentives80
- Confidence55